Running crowdsec as non-root user in Docker?

verybadsoldier · September 18, 2024, 7:15pm

Hi everyone,

I am new to crowdsec and I have set up crowdsec using the Docker container from here in my home lab:
https://hub.docker.com/r/crowdsecurity/crowdsec

The container seems to running as root by default. Is it possible to run it with a non-root user? I tried it, and it worked quite well for the most part, but I get e.g. this error on every startup:

crowdsec  | time="2024-09-18T21:08:17+02:00" level=error msg="unable to open GeoLite2-City.mmdb : open /var/lib/crowdsec/data/GeoLite2-City.mmdb: permission denied"
crowdsec  | time="2024-09-18T21:08:17+02:00" level=warning msg="unable to initialize GeoIP: open /var/lib/crowdsec/data/GeoLite2-City.mmdb: permission denied"

I think the reason is that this directory and its files are only accessible by root user and root group:

f5fb83303192:/$ ls -la /staging/var/lib/crowdsec/data/
total 70504
drwxr-xr-x    3 root     root          4096 Sep 12 11:39 .
drwxr-xr-x    1 root     root          4096 Sep 12 11:39 ..
-rw-------    1 root     root       8404553 Sep 12 11:39 GeoLite2-ASN.mmdb
-rw-------    1 root     root      63771586 Sep 12 11:39 GeoLite2-City.mmdb
drwx------    2 root     root          4096 Sep 12 11:39 trace

This directoy is created here in the Dockerfile:

github.com

crowdsecurity/crowdsec/blob/master/Dockerfile.debian#L55


      
              apt-get install -y -q --install-recommends --no-install-suggests \
              procps \
              systemd \
              iproute2 \
              ca-certificates \
              bash \
              tzdata \
              rsync && \
              mkdir -p /staging/etc/crowdsec && \
              mkdir -p /staging/etc/crowdsec/acquis.d && \
              mkdir -p /staging/var/lib/crowdsec && \
              mkdir -p /var/lib/crowdsec/data
          
          COPY --from=build /go/bin/yq /usr/local/bin/crowdsec /usr/local/bin/cscli /usr/local/bin/
          COPY --from=build /etc/crowdsec /staging/etc/crowdsec
          COPY --from=build /go/src/crowdsec/docker/docker_start.sh /
          COPY --from=build /go/src/crowdsec/docker/config.yaml /staging/etc/crowdsec/config.yaml
          RUN yq -n '.url="http://0.0.0.0:8080"' | install -m 0600 /dev/stdin /staging/etc/crowdsec/local_api_credentials.yaml && \
              yq eval -i ".plugin_config.group = \"nogroup\"" /staging/etc/crowdsec/config.yaml
          
          ENTRYPOINT ["/bin/bash", "docker_start.sh"]

I can change manually the permissions in the running container which seems to work, and I guess, I could also patch the Dockerfile myself to adapt the permissions.

I am surprised I could not find any information online about running crowdsec as non-root user but maybe I had bad luck when searching. Is there an official way to do this? Or is it generally not advised to do so?

Thanks in advance for help!

Topic		Replies	Views
Issues with running on Docker crowdsec	1	1165	February 18, 2022
Crowdsec metabase setup error "unable to find 'groupadd' command" crowdsec	1	18	September 2, 2024
Crowdsec been great i but container restart when configuring notifications	23	211	June 18, 2024
Cscli dashbord setup fail crowdsec	2	716	January 13, 2022
Can't start docker container, acquis.yaml is a directory crowdsec	7	497	June 24, 2024

Running crowdsec as non-root user in Docker?

Related Topics